rea-agents 3.1.0 → 3.2.0

package/dist/cli/setupCommands.js

@@ -3,13 +3,12 @@ import { DOCTOR_PROVIDER_IDS, runDoctor, } from "../application/Doctor.js";
 import { runSetup, systemSetupHost, } from "../application/Setup.js";
 import { runUninstall } from "../application/Uninstall.js";
 import { runUpgrade, systemUpgradeHost } from "../application/Upgrade.js";
-import { conciseSetupResult, confirmInteractiveSetup, renderInteractiveSetupResult, renderSetupProgress, } from "../cliSetup.js";
+import { confirmInteractiveSetup, renderInteractiveSetupResult, renderSetupProgress, } from "../cliSetup.js";
 import { PRODUCT_IDENTITY } from "../identity.js";
 import { logCliCommand } from "../cliLogging.js";
 import { createSystemDoctorHost } from "../doctorRuntime.js";
 import { CLI_COMMANDS } from "../cliCommandNames.js";
 import { SUPPORTED_CLIENT_DEFINITIONS } from "../application/SupportedClients.js";
-import { projectDoctorReport } from "../application/DoctorProjection.js";
 const supportedClientIds = SUPPORTED_CLIENT_DEFINITIONS.map(({ name }) => name);
 const supportedClientSchema = z
     .string()
@@ -53,10 +52,6 @@ const registerSetupCommand = (cli, logger) => {
                 .boolean()
                 .default(false)
                 .describe("Use sequential accessible setup prompts"),
-            detail: z
-                .enum(["summary", "full"])
-                .default("summary")
-                .describe("Summary or complete setup and doctor diagnostics"),
         }),
         alias: { yes: "y" },
         run: ({ options, formatExplicit }) => logCliCommand(logger, "setup", () => runSetupCommand({ options, formatExplicit })),
@@ -79,12 +74,8 @@ const registerDoctorCommand = (cli, logger) => {
                 .boolean()
                 .optional()
                 .describe("Require the installed REA skill identity to be aligned"),
-            detail: z
-                .enum(["summary", "full"])
-                .default("summary")
-                .describe("Summary or complete doctor diagnostics"),
         }),
-        run: ({ options }) => logCliCommand(logger, "doctor", () => runDoctor(options.target, createSystemDoctorHost(), doctorScope(options)).then((report) => projectDoctorReport(report, options.detail))),
+        run: ({ options }) => logCliCommand(logger, "doctor", () => runDoctor(options.target, createSystemDoctorHost(), doctorScope(options))),
     });
 };
 const registerMaintenanceCommands = (cli, logger) => {
@@ -115,7 +106,7 @@ const runSetupCommand = async (input) => {
         : undefined);
     if (interactive)
         renderInteractiveSetupResult(result);
-    return options.detail === "full" ? result : conciseSetupResult(result);
+    return result;
 };
 const setupRunOptions = (input, interactive, hasExplicitScope) => {
     const { options } = input;

package/dist/cli/utilityCommands.js

@@ -2,9 +2,8 @@ import { z } from "incur";
 import { runCapabilityStatus, runProviderAnalysis, runProviderStatus, } from "../application/DirectAnalysis.js";
 import { importReferenceSource } from "../application/ReferenceSourceImport.js";
 import { projectReferenceSourceImportError } from "../application/ReferenceSourceImportTypes.js";
-import { loadConfiguredPermissionAuthority } from "../application/PermissionConfiguration.js";
 import { parseConfig } from "../config.js";
-import { AnalysisProtocolError, PermissionRequiredError, projectAnalysisError, } from "../domain/errors.js";
+import { projectAnalysisError } from "../domain/errors.js";
 import { PRODUCT_IDENTITY } from "../identity.js";
 import { logCliCommand } from "../cliLogging.js";
 import { CLI_COMMANDS } from "../cliCommandNames.js";
@@ -22,15 +21,9 @@ const registerCapabilityCommands = (cli, logger) => {
             description: command === "capabilities"
                 ? "List provider capabilities and side effects"
                 : "List configured analysis providers",
-            options: z.object({
-                detail: z
-                    .enum(["summary", "full"])
-                    .default("summary")
-                    .describe("Summary or complete provider descriptors"),
-            }),
-            run: ({ options }) => logCliCommand(logger, command, () => command === CLI_COMMANDS.providers
-                ? runProviderStatus(logger, options.detail)
-                : runCapabilityStatus(logger, options.detail)),
+            run: () => logCliCommand(logger, command, () => command === CLI_COMMANDS.providers
+                ? runProviderStatus(logger)
+                : runCapabilityStatus(logger)),
         });
     }
 };
@@ -59,13 +52,12 @@ const registerNativeCommands = (cli, logger) => {
         run: ({ args, options }) => logCliCommand(logger, "inspect-plist", () => runProviderAnalysis(args.path, "inspect_plist", { relative_path: options.relativePath }, logger)),
     });
     cli.command(CLI_COMMANDS.demangleSwift, {
-        description: "Demangle a bounded Swift symbol batch without Hopper",
+        description: "Demangle Swift symbols without Hopper",
         args: z.object({
             path: z.string().describe("Artifact path used for evidence identity"),
             symbols: z
                 .array(z.string().min(1))
                 .min(1)
-                .max(500)
                 .describe("Swift mangled symbols to demangle"),
         }),
         run: ({ args }) => logCliCommand(logger, "demangle-swift", () => runProviderAnalysis(args.path, "demangle_swift", { symbols: args.symbols }, logger)),
@@ -73,11 +65,11 @@ const registerNativeCommands = (cli, logger) => {
 };
 const registerReferenceSourceCommand = (cli, logger) => {
     cli.command(CLI_COMMANDS.importReferenceSource, {
-        description: "Import a bounded source tree as historical reference only",
+        description: "Import a source tree as historical reference only",
         args: z.object({
             root: z
                 .string()
-                .describe("Source root allowed by REA_REFERENCE_ROOTS_JSON"),
+                .describe("Local source directory to import as historical reference"),
         }),
         run: ({ args }) => logCliCommand(logger, "import-reference-source", async () => {
             const config = parseConfig(process.env);
@@ -86,32 +78,6 @@ const registerReferenceSourceCommand = (cli, logger) => {
                     error: "Import failed",
                     ...projectAnalysisError(config.error),
                 };
-            const authority = await loadConfiguredPermissionAuthority(config.value);
-            if (!authority.ok)
-                return {
-                    error: "Import failed",
-                    ...projectAnalysisError(authority.error),
-                };
-            const authorized = await authority.value.authorize({
-                capability: "reference_read",
-                roots: [args.root],
-                executables: [],
-                environment_names: [],
-                network: "none",
-                mount: false,
-                operation_identity: `import_reference_source:${args.root}`,
-            }, "read");
-            if (!authorized.ok) {
-                const error = authorized.error instanceof PermissionRequiredError
-                    ? authorized.error
-                    : new AnalysisProtocolError(authorized.error.message, {
-                        cause: authorized.error,
-                    });
-                return {
-                    error: "Import failed",
-                    ...projectAnalysisError(error),
-                };
-            }
             const imported = await importReferenceSource({
                 root: args.root,
                 caller: "rea-cli",

package/dist/cli.js

@@ -7,7 +7,6 @@ import { registerCoreAnalysisCommands } from "./cli/coreAnalysisCommands.js";
 import { registerUtilityCommands } from "./cli/utilityCommands.js";
 import { registerArtifactCommands } from "./cli/artifactCommands.js";
 import { registerManagedCommands } from "./cli/managedCommands.js";
-import { registerInvestigationCommands } from "./cliInvestigationCommands.js";
 import { registerEvidenceCommands } from "./cliEvidenceCommands.js";
 import { registerProcessCommands } from "./cliProcessCommands.js";
 import { registerPolicyCommands } from "./cliPolicyCommands.js";
@@ -48,7 +47,6 @@ export const createCli = () => {
     registerUtilityCommands(cli, logger);
     registerArtifactCommands(cli, logger);
     registerManagedCommands(cli, logger);
-    registerInvestigationCommands(cli, logger);
     registerEvidenceCommands(cli, logger);
     registerProcessCommands(cli, logger);
     registerPolicyCommands(cli, logger);

package/dist/cliApplicationCommands.js

@@ -1,22 +1,26 @@
 import { Cli, z } from "incur";
 import { compareApplicationVersionsEvidenceValidated, compareJavaScriptExportShapesEvidenceValidated, compareSourceToBundleEvidenceValidated, traceApplicationFeatureEvidenceValidated, } from "./application/JavaScriptApplicationWorkflowService.js";
 import { traceJavaScriptSemanticsEvidenceValidated } from "./application/JavaScriptSemanticTraceService.js";
-import { resolveCompareApplicationVersionsRequest, resolveCompareJavaScriptExportShapesRequest, resolveCompareSourceToBundleRequest, resolveTraceApplicationFeatureRequest, resolveTraceJavaScriptSemanticsRequest, } from "./application/ApplicationWorkflowEvidenceResolver.js";
-import { readEvidenceBundle } from "./application/EvidenceBundleFiles.js";
 import { runControlledReplay } from "./application/JavaScriptReplayService.js";
 import { executeNodeCharacterization, prepareNodeCharacterization, } from "./application/NodeRuntimeCharacterizationService.js";
-import { commitReconstructionCoverage, queryReconstructionCoverage, reconstructionCoverageCommitInputSchema, reconstructionCoverageQueryInputSchema, } from "./application/ReconstructionCoverageService.js";
-import { buildReconstructionObligationLedgerEvidenceValidated, resolveReconstructionObligationLedgerRequest, } from "./application/ReconstructionObligationLedgerService.js";
-import { evaluateReconstructionReadinessValidated, resolveReconstructionReadinessRequest, } from "./application/ReconstructionReadinessService.js";
-import { authorizeFileReadWithDeferredWrite, authorizeRootPermission, } from "./application/DeferredFileAuthorization.js";
+import { evaluateReconstructionCoverage, reconstructionCoverageEvaluationInputSchema, } from "./application/ReconstructionCoverageService.js";
+import { buildReconstructionObligationLedgerEvidenceValidated } from "./application/ReconstructionObligationLedgerService.js";
 import { loadConfiguredPermissionAuthority } from "./application/PermissionConfiguration.js";
 import { CLI_COMMANDS } from "./cliCommandNames.js";
 import { parseCliJsonInput } from "./cliJsonInput.js";
 import { logCliCommand } from "./cliLogging.js";
 import { AnalysisInputError, projectAnalysisError, } from "./domain/errors.js";
+import { jsonValueSchema } from "./domain/jsonValue.js";
 import { parseConfig } from "./config.js";
 import { LinuxJavaScriptReplayRunner } from "./replay/LinuxJavaScriptReplayRunner.js";
 import { SystemJavaScriptReplayHost } from "./replay/SystemJavaScriptReplayHost.js";
+import { traceApplicationFeatureInputSchema } from "./domain/javascriptFeatureTraceSchemas.js";
+import { traceJavaScriptSemanticsInputSchema } from "./domain/javascriptSemanticTraceSchemas.js";
+import { compareApplicationVersionsInputSchema } from "./domain/javascriptApplicationVersionComparisonSchemas.js";
+import { compareSourceToBundleInputSchema } from "./domain/sourceToBundleComparisonSchemas.js";
+import { compareJavaScriptExportShapesInputSchema } from "./domain/javascriptExportShapeComparisonSchemas.js";
+import { projectInputIssues } from "./domain/inputIssueProjection.js";
+import { reconstructionObligationLedgerInputSchema } from "./domain/reconstructionObligationLedgerSchemas.js";
 /** Register CLI equivalents of provider-neutral application graph workflows. */
 export const registerApplicationCommands = (cli, logger) => {
     registerJsonCommand({
@@ -24,7 +28,7 @@ export const registerApplicationCommands = (cli, logger) => {
         logger,
         name: CLI_COMMANDS.traceApplicationFeature,
         description: "Trace a typed seed through authenticated application Evidence JSON",
-        resolveInput: resolveTraceApplicationFeatureRequest,
+        inputSchema: traceApplicationFeatureInputSchema,
         workflow: traceApplicationFeatureEvidenceValidated,
     });
     registerJsonCommand({
@@ -32,7 +36,7 @@ export const registerApplicationCommands = (cli, logger) => {
         logger,
         name: CLI_COMMANDS.traceJavaScriptSemantics,
         description: "Trace bounded static semantic relations through authenticated application Evidence",
-        resolveInput: resolveTraceJavaScriptSemanticsRequest,
+        inputSchema: traceJavaScriptSemanticsInputSchema,
         workflow: traceJavaScriptSemanticsEvidenceValidated,
     });
     registerJsonCommand({
@@ -40,7 +44,7 @@ export const registerApplicationCommands = (cli, logger) => {
         logger,
         name: CLI_COMMANDS.compareApplicationVersions,
         description: "Compare two authenticated JavaScript Application Graph versions",
-        resolveInput: resolveCompareApplicationVersionsRequest,
+        inputSchema: compareApplicationVersionsInputSchema,
         workflow: compareApplicationVersionsEvidenceValidated,
     });
     registerJsonCommand({
@@ -48,7 +52,7 @@ export const registerApplicationCommands = (cli, logger) => {
         logger,
         name: CLI_COMMANDS.compareSourceToBundle,
         description: "Compare committed historical source with authenticated application Evidence",
-        resolveInput: resolveCompareSourceToBundleRequest,
+        inputSchema: compareSourceToBundleInputSchema,
         workflow: compareSourceToBundleEvidenceValidated,
     });
     registerJsonCommand({
@@ -56,7 +60,7 @@ export const registerApplicationCommands = (cli, logger) => {
         logger,
         name: CLI_COMMANDS.compareJavaScriptExportShapes,
         description: "Compare exact static JavaScript export return shapes without execution",
-        resolveInput: resolveCompareJavaScriptExportShapesRequest,
+        inputSchema: compareJavaScriptExportShapesInputSchema,
         workflow: compareJavaScriptExportShapesEvidenceValidated,
     });
     cli.command(CLI_COMMANDS.runControlledReplay, {
@@ -98,24 +102,20 @@ export const registerApplicationCommands = (cli, logger) => {
         workflow: (config, authority, input) => executeNodeCharacterization(replayDependencies(config, authority), input),
     });
     registerObligationLedgerCommand(cli, logger);
-    registerReadinessCommand(cli, logger);
-    registerCoverageCommands(cli, logger);
+    registerCoverageCommand(cli, logger);
 };
 const registerObligationLedgerCommand = (cli, logger) => registerJsonCommand({
     cli,
     logger,
     name: CLI_COMMANDS.buildReconstructionObligationLedger,
     description: "Generate a deterministic Evidence-backed reconstruction obligation ledger page",
-    resolveInput: resolveReconstructionObligationLedgerRequest,
-    workflow: buildReconstructionObligationLedgerEvidenceValidated,
-});
-const registerReadinessCommand = (cli, logger) => registerJsonCommand({
-    cli,
-    logger,
-    name: CLI_COMMANDS.evaluateReconstructionReadiness,
-    description: "Evaluate a complete Evidence-backed reconstruction readiness journey",
-    resolveInput: resolveReconstructionReadinessRequest,
-    workflow: evaluateReconstructionReadinessValidated,
+    inputSchema: reconstructionObligationLedgerInputSchema,
+    workflow: (input) => {
+        const result = buildReconstructionObligationLedgerEvidenceValidated(input);
+        return result.ok
+            ? { ok: true, value: jsonValueSchema.parse(result.value) }
+            : result;
+    },
 });
 const registerAuthorizedJsonCommand = ({ cli, logger, name, description, workflow, }) => {
     cli.command(name, {
@@ -135,57 +135,19 @@ const registerAuthorizedJsonCommand = ({ cli, logger, name, description, workflo
         }),
     });
 };
-const registerCoverageCommands = (cli, logger) => {
-    registerAuthorizedJsonCommand({
-        cli,
-        logger,
-        name: CLI_COMMANDS.commitReconstructionCoverage,
-        description: "Commit one canonical reconstruction coverage workspace revision",
-        workflow: async (config, authority, input) => {
-            const parsed = reconstructionCoverageCommitInputSchema.safeParse(input);
-            if (!parsed.success)
-                return {
-                    ok: false,
-                    error: new AnalysisInputError(CLI_COMMANDS.commitReconstructionCoverage, { cause: parsed.error }),
-                };
-            const authorization = await authorizeFileReadWithDeferredWrite(authority, {
-                path: parsed.data.workspace_path,
-                readCapability: "investigation_workspace_read",
-                writeCapability: "investigation_workspace_write",
-                operation: CLI_COMMANDS.commitReconstructionCoverage,
-            });
-            if (!authorization.ok)
-                return authorization;
-            const write = await authorization.value.authorizeWrite();
-            if (!write.ok)
-                return write;
-            return commitReconstructionCoverage(parsed.data, config.evidenceFilePolicy);
-        },
-    });
-    registerAuthorizedJsonCommand({
-        cli,
-        logger,
-        name: CLI_COMMANDS.queryReconstructionCoverage,
-        description: "Evaluate one fail-closed reconstruction coverage boundary",
-        workflow: async (config, authority, input) => {
-            const parsed = reconstructionCoverageQueryInputSchema.safeParse(input);
-            if (!parsed.success)
-                return {
-                    ok: false,
-                    error: new AnalysisInputError(CLI_COMMANDS.queryReconstructionCoverage, { cause: parsed.error }),
-                };
-            const authorized = await authorizeRootPermission(authority, {
-                capability: "investigation_workspace_read",
-                roots: [parsed.data.workspace_path],
-                access: "read",
-                operation: CLI_COMMANDS.queryReconstructionCoverage,
-            });
-            if (!authorized.ok)
-                return authorized;
-            return queryReconstructionCoverage(parsed.data, config.evidenceFilePolicy, Date.now());
-        },
-    });
-};
+const registerCoverageCommand = (cli, logger) => registerJsonCommand({
+    cli,
+    logger,
+    name: CLI_COMMANDS.evaluateReconstructionCoverage,
+    description: "Evaluate inline fail-closed reconstruction coverage",
+    inputSchema: reconstructionCoverageEvaluationInputSchema,
+    workflow: (input) => {
+        const result = evaluateReconstructionCoverage(input);
+        return result.ok
+            ? { ok: true, value: jsonValueSchema.parse(result.value) }
+            : result;
+    },
+});
 const configuredAuthority = async () => {
     const configured = await loadConfiguredAuthority();
     return configured.ok
@@ -198,35 +160,23 @@ const replayDependencies = (config, authority) => ({
     runner: new LinuxJavaScriptReplayRunner(),
     authority,
 });
-const registerJsonCommand = ({ cli, logger, name, description, resolveInput, workflow, }) => {
+const registerJsonCommand = ({ cli, logger, name, description, inputSchema, workflow, }) => {
     cli.command(name, {
         description,
         args: z.object({
             inputJson: z.string().describe("Inline workflow JSON or JSON file path"),
         }),
-        options: z.object({
-            evidenceBundle: z
-                .string()
-                .optional()
-                .describe("Authorized Evidence bundle used to resolve Evidence IDs"),
-        }),
-        run: ({ args, options }) => logCliCommand(logger, name, async () => {
+        run: ({ args }) => logCliCommand(logger, name, async () => {
             const input = await parseCliJsonInput(args.inputJson, name);
             if (!input.ok)
                 return input.error;
-            const lookup = await loadEvidenceLookup(options.evidenceBundle, name);
-            if (!lookup.ok)
-                return {
-                    error: "Application workflow failed",
-                    ...projectAnalysisError(lookup.error),
-                };
-            const resolved = resolveInput(input.value, lookup.value);
-            if (!resolved.ok)
+            const parsed = inputSchema.safeParse(input.value);
+            if (!parsed.success)
                 return {
                     error: "Application workflow failed",
-                    ...projectAnalysisError(resolved.error),
+                    ...projectAnalysisError(new AnalysisInputError(name, undefined, projectInputIssues(parsed.error.issues, input.value))),
                 };
-            const result = workflow(resolved.value);
+            const result = workflow(parsed.data);
             return result.ok
                 ? result.value
                 : {
@@ -236,26 +186,6 @@ const registerJsonCommand = ({ cli, logger, name, description, resolveInput, wor
         }),
     });
 };
-const loadEvidenceLookup = async (bundlePath, operation) => {
-    if (bundlePath === undefined)
-        return { ok: true, value: undefined };
-    const configured = await loadConfiguredAuthority();
-    if (!configured.ok)
-        return configured;
-    const authorized = await authorizeRootPermission(configured.authority, {
-        capability: "evidence_read",
-        roots: [bundlePath],
-        access: "read",
-        operation,
-    });
-    if (!authorized.ok)
-        return authorized;
-    const loaded = await readEvidenceBundle(bundlePath, configured.config.evidenceFilePolicy);
-    if (!loaded.ok)
-        return loaded;
-    const records = new Map(loaded.value.records.map((record) => [record.evidence_id, record]));
-    return { ok: true, value: (evidenceId) => records.get(evidenceId) };
-};
 const loadConfiguredAuthority = async () => {
     const config = parseConfig(process.env);
     if (!config.ok)

package/dist/cliBrowserAdvancedCommands.js

@@ -1,21 +1,14 @@
 import { Cli, z } from "incur";
+import { browserContext, browserCliError } from "./cliBrowserContext.js";
+import { browserScopeOptions } from "./cliObservationOptions.js";
 import { captureWebScreenshot, compareWebCaptureEvidence, compareWebScreenshotEvidence, discoverWebMcpTools, } from "./application/BrowserObservationService.js";
-import { loadConfiguredPermissionAuthority } from "./application/PermissionConfiguration.js";
 import { CdpBrowserProvider } from "./browser/CdpBrowserProvider.js";
 import { logCliCommand } from "./cliLogging.js";
-import { parseConfig } from "./config.js";
-import { AnalysisCapabilityUnavailableError, AnalysisInputError, projectAnalysisError, } from "./domain/errors.js";
+import { AnalysisInputError } from "./domain/errors.js";
 import { browserCaptureComparisonInputSchema } from "./domain/browserCaptureComparison.js";
 import { discoverWebMcpToolsInputSchema } from "./domain/webMcpDiscovery.js";
 import { captureWebScreenshotInputSchema, compareWebScreenshotsInputSchema, } from "./domain/webScreenshot.js";
 import { CLI_COMMANDS } from "./cliCommandNames.js";
-const scopeOptions = {
-    allowedOrigins: z
-        .array(z.string().min(1))
-        .optional()
-        .describe("Exact origins to observe; defaults to REA_BROWSER_ALLOWED_ORIGINS_JSON"),
-    approved: z.boolean().default(false).describe("Approve passive observation"),
-};
 /** Register WebMCP, capture-diff, and screenshot CLI equivalents. */
 export const registerAdvancedBrowserCommands = (cli, logger) => {
     registerWebMcp(cli, logger);
@@ -31,42 +24,13 @@ const registerWebMcp = (cli, logger) => {
             targetId: z.string().describe("Target ID from list-browser-targets"),
         }),
         options: z.object({
-            ...scopeOptions,
+            ...browserScopeOptions,
             observationMs: z
                 .number()
                 .int()
                 .min(0)
-                .max(10_000)
                 .default(100)
                 .describe("Observation duration in milliseconds"),
-            maxTools: z
-                .number()
-                .int()
-                .min(1)
-                .max(5_000)
-                .default(500)
-                .describe("Maximum page-declared WebMCP tools to return"),
-            maxSchemaBytes: z
-                .number()
-                .int()
-                .min(1)
-                .max(1_024 * 1_024)
-                .default(256 * 1_024)
-                .describe("Maximum serialized size of one declared tool schema"),
-            maxSchemaNodes: z
-                .number()
-                .int()
-                .min(1)
-                .max(100_000)
-                .default(5_000)
-                .describe("Maximum nodes in one declared tool schema"),
-            maxSchemaDepth: z
-                .number()
-                .int()
-                .min(1)
-                .max(100)
-                .default(20)
-                .describe("Maximum nesting depth in one declared tool schema"),
         }),
         run: ({ args, options }) => logCliCommand(logger, "discover-webmcp-tools", async () => {
             const context = await browserContext("discover_webmcp_tools");
@@ -76,17 +40,12 @@ const registerWebMcp = (cli, logger) => {
                 cdp_endpoint: args.endpoint,
                 allowed_origins: options.allowedOrigins ?? context.allowedBrowserOrigins,
                 target_id: args.targetId,
-                approved: options.approved,
                 observation_ms: options.observationMs,
-                max_tools: options.maxTools,
-                max_schema_bytes: options.maxSchemaBytes,
-                max_schema_nodes: options.maxSchemaNodes,
-                max_schema_depth: options.maxSchemaDepth,
             });
             if (!parsed.success)
                 return inputError("discover_webmcp_tools");
             const result = await discoverWebMcpTools(context.provider, context.authority, parsed.data);
-            return result.ok ? result.value : cliError(result.error);
+            return result.ok ? result.value : browserCliError(result.error);
         }),
     });
 };
@@ -98,13 +57,6 @@ const registerCaptureDiff = (cli, logger) => {
             afterJson: z.string().describe("Later normalized web capture JSON"),
         }),
         options: z.object({
-            maxChanges: z
-                .number()
-                .int()
-                .min(1)
-                .max(20_000)
-                .default(2_000)
-                .describe("Maximum normalized changes to return"),
             normalizationJson: z
                 .string()
                 .default('{"rules":[]}')
@@ -117,19 +69,17 @@ const registerCaptureDiff = (cli, logger) => {
                 before_scenario: before,
                 after_scenario: after,
                 normalization: parseJson(options.normalizationJson),
-                max_changes: options.maxChanges,
             });
             const parsed = scenarioComparison.success
                 ? scenarioComparison
                 : browserCaptureComparisonInputSchema.safeParse({
                     before,
                     after,
-                    max_changes: options.maxChanges,
                 });
             if (!parsed.success)
                 return inputError("compare_web_captures");
             const result = await compareWebCaptureEvidence(new CdpBrowserProvider(), parsed.data);
-            return result.ok ? result.value : cliError(result.error);
+            return result.ok ? result.value : browserCliError(result.error);
         }),
     });
 };
@@ -141,18 +91,7 @@ const registerScreenshot = (cli, logger) => {
             targetId: z.string().describe("Target ID from list-browser-targets"),
         }),
         options: z.object({
-            ...scopeOptions,
-            screenshotApproved: z
-                .boolean()
-                .default(false)
-                .describe("Approve capturing the visible page viewport"),
-            maximumImageBytes: z
-                .number()
-                .int()
-                .min(1)
-                .max(8 * 1_024 * 1_024)
-                .default(4 * 1_024 * 1_024)
-                .describe("Maximum captured PNG size"),
+            ...browserScopeOptions,
         }),
         run: ({ args, options }) => logCliCommand(logger, "capture-web-screenshot", async () => {
             const context = await browserContext("capture_web_screenshot");
@@ -162,14 +101,11 @@ const registerScreenshot = (cli, logger) => {
                 cdp_endpoint: args.endpoint,
                 allowed_origins: options.allowedOrigins ?? context.allowedBrowserOrigins,
                 target_id: args.targetId,
-                approved: options.approved,
-                screenshot_approved: options.screenshotApproved,
-                maximum_image_bytes: options.maximumImageBytes,
             });
             if (!parsed.success)
                 return inputError("capture_web_screenshot");
             const result = await captureWebScreenshot(context.provider, context.authority, parsed.data);
-            return result.ok ? result.value : cliError(result.error);
+            return result.ok ? result.value : browserCliError(result.error);
         }),
     });
 };
@@ -188,48 +124,20 @@ const registerScreenshotDiff = (cli, logger) => {
                 .max(255)
                 .default(0)
                 .describe("Per-channel difference threshold for changed pixels"),
-            maximumPixels: z
-                .number()
-                .int()
-                .min(1)
-                .max(32_000_000)
-                .default(16_000_000)
-                .describe("Maximum decoded pixels per screenshot"),
         }),
         run: ({ args, options }) => logCliCommand(logger, "compare-web-screenshots", async () => {
             const parsed = compareWebScreenshotsInputSchema.safeParse({
                 before: parseJson(args.beforeJson),
                 after: parseJson(args.afterJson),
                 channel_threshold: options.channelThreshold,
-                maximum_pixels: options.maximumPixels,
             });
             if (!parsed.success)
                 return inputError("compare_web_screenshots");
             const result = await compareWebScreenshotEvidence(new CdpBrowserProvider(), parsed.data);
-            return result.ok ? result.value : cliError(result.error);
+            return result.ok ? result.value : browserCliError(result.error);
         }),
     });
 };
-const browserContext = async (operation) => {
-    const config = parseConfig(process.env);
-    if (!config.ok)
-        return { ok: false, error: cliError(config.error) };
-    const policy = config.value.browserObservationPolicy;
-    if (policy.status === "disabled")
-        return {
-            ok: false,
-            error: cliError(new AnalysisCapabilityUnavailableError("rea-cdp-browser", operation, "browser observation is disabled; configure exact endpoints and origins before enabling it")),
-        };
-    const authority = await loadConfiguredPermissionAuthority(config.value);
-    if (!authority.ok)
-        return { ok: false, error: cliError(authority.error) };
-    return {
-        ok: true,
-        authority: authority.value,
-        provider: new CdpBrowserProvider(),
-        allowedBrowserOrigins: policy.allowedOrigins,
-    };
-};
 const parseJson = (value) => {
     try {
         return JSON.parse(value);
@@ -238,8 +146,4 @@ const parseJson = (value) => {
         return undefined;
     }
 };
-const inputError = (operation) => cliError(new AnalysisInputError(operation));
-const cliError = (error) => ({
-    error: "Browser observation failed",
-    ...projectAnalysisError(error),
-});
+const inputError = (operation) => browserCliError(new AnalysisInputError(operation));